From 69d7fc4a39a588436a4ad14ac09b8d5eeb6633c2 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 28 Jul 2026 14:17:51 +0000
Subject: [PATCH] fix(env): don't leak nixpkgs SOURCE_DATE_EPOCH into the shell
 (#2597)

The nixpkgs stdenv sets SOURCE_DATE_EPOCH to a fixed timestamp
(315532800 = 1980-01-01) so that builds are reproducible. Devbox sources
the variables from `nix print-dev-env` into the interactive shell, which
leaked this value into every Devbox environment.

As a result, any timestamp-respecting tool run inside the shell stamps
its output with 1980 instead of the current time. The most visible
symptom is Docker images showing up as created "45 years ago", which can
trip age-based registry cleanup and delete freshly built images. It also
affects tar, gzip, and other build tools.

Add SOURCE_DATE_EPOCH to ignoreDevEnvVar so Devbox ignores the
Nix-provided value and falls back to the current environment (normally
unset, so tools use the real time), mirroring how HOME and TMPDIR are
already handled. Users who want reproducible builds can still set
SOURCE_DATE_EPOCH explicitly via devbox.json's env block, which is
layered on top of these variables.

Fixes #2597
---
 internal/devbox/devbox.go                  | 32 ++++++++++++++++------
 testscripts/run/source_date_epoch.test.txt | 15 ++++++++++
 2 files changed, 39 insertions(+), 8 deletions(-)
 create mode 100644 testscripts/run/source_date_epoch.test.txt

diff --git a/internal/devbox/devbox.go b/internal/devbox/devbox.go
index 4c3f82421ce..cbf55f5b129 100644
--- a/internal/devbox/devbox.go
+++ b/internal/devbox/devbox.go
@@ -1079,8 +1079,9 @@ var ignoreCurrentEnvVar = map[string]bool{
 // ignoreDevEnvVar contains environment variables that Devbox should remove from
 // the slice of [Devbox.PrintDevEnv] variables before sourcing them.
 //
-// This list comes directly from the "nix develop" source:
+// Most of this list comes directly from the "nix develop" source:
 // https://github.com/NixOS/nix/blob/f08ad5bdbac02167f7d9f5e7f9bab57cf1c5f8c4/src/nix/develop.cc#L257-L275
+// Entries not in that list are called out below.
 var ignoreDevEnvVar = map[string]bool{
 	"BASHOPTS":           true,
 	"HOME":               true,
@@ -1091,13 +1092,28 @@ var ignoreDevEnvVar = map[string]bool{
 	"PPID":               true,
 	"SHELL":              true,
 	"SHELLOPTS":          true,
-	"TEMP":               true,
-	"TEMPDIR":            true,
-	"TERM":               true,
-	"TMP":                true,
-	"TMPDIR":             true,
-	"TZ":                 true,
-	"UID":                true,
+
+	// SOURCE_DATE_EPOCH is set by the nixpkgs stdenv to a fixed timestamp
+	// (315532800 = 1980-01-01) so that *builds* are reproducible. Leaking it
+	// into the interactive Devbox shell makes any timestamp-respecting tool run
+	// there stamp its output with 1980 instead of the current time. The most
+	// visible symptom is Docker images showing up as created "45 years ago"
+	// (which can trip age-based registry cleanup), but it also affects tar,
+	// gzip, and other build tools. Ignore the Nix-provided value so the shell
+	// falls back to the current environment (normally unset, so tools use the
+	// real time). Users who genuinely want reproducible builds can still set
+	// SOURCE_DATE_EPOCH explicitly via devbox.json's env block, which is layered
+	// on top of these variables. See
+	// https://github.com/jetify-com/devbox/issues/2597.
+	"SOURCE_DATE_EPOCH": true,
+
+	"TEMP":    true,
+	"TEMPDIR": true,
+	"TERM":    true,
+	"TMP":     true,
+	"TMPDIR":  true,
+	"TZ":      true,
+	"UID":     true,
 }
 
 func (d *Devbox) ProjectDirHash() string {
diff --git a/testscripts/run/source_date_epoch.test.txt b/testscripts/run/source_date_epoch.test.txt
new file mode 100644
index 00000000000..2a586458e8b
--- /dev/null
+++ b/testscripts/run/source_date_epoch.test.txt
@@ -0,0 +1,15 @@
+# The nixpkgs stdenv sets SOURCE_DATE_EPOCH to a fixed timestamp
+# (315532800 = 1980-01-01) so that builds are reproducible. Devbox must not
+# leak that value into the interactive shell, otherwise timestamp-respecting
+# tools (docker build, tar, gzip, ...) stamp their output with 1980 -- e.g.
+# Docker images show up as created "45 years ago". See
+# https://github.com/jetify-com/devbox/issues/2597.
+
+exec devbox run echo 'epoch=<$SOURCE_DATE_EPOCH>'
+stdout 'epoch=<'
+! stdout '315532800'
+
+-- devbox.json --
+{
+  "packages": []
+}